LLM supply chain vulnerabilities emerge from compromised models, datasets, plugins, SDKs, and hosting dependencies. A single weak link can introduce malicious behavior, data leakage, or policy bypass into production systems. The distributed nature of AI stacks increases complexity and weakens traditional dependency controls.
Adopt provenance verification for models and dependencies, pin versions, and enforce trusted artifact sources. Continuously scan third-party components for vulnerabilities and policy violations. Maintain rollback-ready deployment controls and periodic supplier risk reviews to reduce compromise impact.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#05llm05-2024 Supply Chain Vulnerabilities
